{"schema_version":"1.9.2","id":"GO-2026-6873","published":"2026-11-05T22:54:32Z","modified":"2026-11-05T23:15:18.160254083Z","aliases":["CVE-2026-118650","GHSA-375p-5qhx-8wq4"],"summary":"URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo","details":"URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo","affected":[{"package":{"name":"github.com/labstack/echo/v4","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v4/middleware","symbols":["MethodOverride","MethodOverrideWithConfig","Proxy","ProxyWithConfig","Secure","SecureWithConfig","Static","StaticWithConfig","sanitizeURI"]},{"path":"github.com/labstack/echo/v4","symbols":["Echo.ServeHTTP","Echo.Start","Echo.StartAutoTLS","Echo.StartH2CServer","Echo.StartServer","Echo.StartTLS","Echo.Static","Echo.StaticFS","Group.Static","Group.StaticFS","StaticDirectoryHandler","context.JSONP","context.JSONPBlob","context.Scheme","context.jsonPBlob","isValidProto","sanitizeURI"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6873.json"}},{"package":{"name":"github.com/labstack/echo/v5","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v5/middleware","symbols":["AddTrailingSlash","AddTrailingSlashWithConfig","BasicAuth","BasicAuthWithConfig","BodyDump","BodyDumpWithConfig","BodyLimit","BodyLimitWithConfig","CORS","CORSWithConfig","CSRF","CSRFWithConfig","ContextTimeout","ContextTimeoutWithConfig","Decompress","DecompressWithConfig","Gzip","GzipWithConfig","HTTPSNonWWWRedirect","HTTPSNonWWWRedirectWithConfig","HTTPSRedirect","HTTPSRedirectWithConfig","HTTPSWWWRedirect","HTTPSWWWRedirectWithConfig","KeyAuth","KeyAuthWithConfig","MethodOverride","MethodOverrideConfig.ToMiddleware","MethodOverrideWithConfig","NonWWWRedirect","NonWWWRedirectWithConfig","Proxy","ProxyConfig.ToMiddleware","ProxyWithConfig","RateLimiter","RateLimiterWithConfig","Recover","RecoverWithConfig","RemoveTrailingSlash","RemoveTrailingSlashWithConfig","RequestID","RequestIDWithConfig","Rewrite","RewriteWithConfig","Secure","SecureConfig.ToMiddleware","SecureWithConfig","Static","StaticConfig.ToMiddleware","StaticWithConfig","WWWRedirect","WWWRedirectWithConfig","sanitizeURI"]},{"path":"github.com/labstack/echo/v5","symbols":["Context.JSONP","Context.JSONPBlob","Context.Scheme","Context.jsonPBlob","Echo.ServeHTTP","Echo.Start","Echo.Static","Echo.StaticFS","Group.Static","Group.StaticFS","NewWithConfig","StartConfig.Start","StartConfig.StartTLS","StaticDirectoryHandler","isValidProto","sanitizeURI"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6873.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v4.16.0"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v5.4.0"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6873"}}